I-Worm.Magistr?

Thread View: alt.comp.virus

2 messages

[T] Back to Threads [V] Tree View [G] Group Articles

2 total messages Started by Tonja Wed, 30 May 2001 18:57

#470

Author: Tonja
Date: Wed, 30 May 2001 18:57

19 lines
2135 bytes

After downloading "kaspersky lab's avp" the following was found:
(my former virusscanner didn't find infected files though)

C:\WINDOWS\Application
Data\Identities\{6BF20820-9DF2-11D8-B641-B90EF3CAED54}\Microsoft\Outlook
Express\Postvak IN.dbx/
[From:  mail@tonja.nl][Date:  Sun, 6 May 2001 21:00:07 +0200 (MET
DST)]:\IDLE32.EXE infected: I-Worm.Magistr

I think this is about a mail I received from somebody I don't know. It
didn't have an attachment but the text in the mail was in some code.
After deleting the mail I scanned my system for the second time and nothing
was found. Isn't that strange?

At http://www.symantec.com/avcenter/venc/data/w32.magistr.24876@mm.html I
found some scary information about this virus.
Can someone tell me more about this one, I allways read that only
attachments can contain virusses, that isn't true is it?
Thanks in advance.

Re: I-Worm.Magistr?

#471

Author: Michael Salem
Date: Thu, 31 May 2001 09:20

30 lines
2509 bytes

Tonja wrote:

> After downloading "kaspersky lab's avp" the following was found:
> (my former virusscanner didn't find infected files though)
> 
> C:\WINDOWS\Application
> Data\Identities\{6BF20820-9DF2-11D8-B641-B90EF3CAED54}\Microsoft\Outlook
> Express\Postvak IN.dbx/
> [From:  mail@tonja.nl][Date:  Sun, 6 May 2001 21:00:07 +0200 (MET
> DST)]:\IDLE32.EXE infected: I-Worm.Magistr
> 
> I think this is about a mail I received from somebody I don't know. It
> didn't have an attachment but the text in the mail was in some code.
> After deleting the mail I scanned my system for the second time and nothing
> was found. Isn't that strange?

Been there, done that, but with a different virus. If your setup 
supports HTML in email (in my view it shouldn't) and if your system 
is set up to support scripting (in my view it usually shouldn't), you 
can get infected by a script embedded in an HTML message, with no 
need for an attachment.

If your virus scanner first reports a virus and cleans it; a later 
report finds no virus; but you still see signs of infection, it means 
the scanner doesn't deal properly with this virus. Quite common with 
new viruses; later versions of scanners do better.

HTH,
-- 
Michael Salem

Thread Navigation

This is a paginated view of messages in the thread with full content displayed inline.

Messages are displayed in chronological order, with the original post highlighted in green.

Use pagination controls to navigate through all messages in large threads.

Back to All Threads